CVE-2025-40720: Quiter Gateway XSS Vulnerability

CVE-2025-40720 Overview

CVE-2025-40720 is a Reflected Cross-Site Scripting (XSS) vulnerability affecting Quiter Gateway versions prior to 4.7.0. The flaw exists in the campo parameter of the /<Client>FacturaE/VerFacturaPDF endpoint. Attackers can craft malicious URLs that execute arbitrary JavaScript in a victim's browser when the link is opened. The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation). Exploitation requires user interaction, typically through phishing or social engineering, to lure a victim into clicking the crafted URL.

Critical Impact
Attackers can execute arbitrary JavaScript in a victim's browser session, enabling session hijacking, credential theft, and unauthorized actions within the Quiter Gateway application context.

Affected Products

Quiter Gateway versions prior to 4.7.0
Vendor: Quiter
Component: quiter:quiter_gateway

Discovery Timeline

2025-07-08 - CVE-2025-40720 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-40720

Vulnerability Analysis

The vulnerability resides in the VerFacturaPDF endpoint of Quiter Gateway. The application accepts user-controlled input through the campo query parameter and reflects it into the HTTP response without proper output encoding or input sanitization. When a victim opens a crafted link, the injected payload executes in the browser under the origin of the Quiter Gateway application.

This is a classic reflected XSS pattern [CWE-79]. Because the payload is delivered via the URL, no persistent storage on the server is required. The Quiter Gateway application processes electronic invoicing workflows, so the impacted origin often holds sensitive customer and financial data. An attacker with the ability to execute script in that origin can read authenticated session content and issue authenticated requests on the user's behalf.

Root Cause

The root cause is missing or inadequate neutralization of special characters in the campo parameter before it is rendered in the response body. The application trusts client-supplied input and echoes it into HTML output, allowing HTML and JavaScript constructs to be interpreted by the browser rather than treated as literal text.

Attack Vector

Exploitation is network-based and requires user interaction. An attacker constructs a URL targeting /<Client>FacturaE/VerFacturaPDF with a JavaScript payload in the campo parameter and distributes it via email, chat, or a malicious website. When an authenticated Quiter Gateway user opens the link, the browser executes the payload in the context of the Quiter Gateway origin. Refer to the INCIBE Security Notice for the coordinated disclosure details.

Detection Methods for CVE-2025-40720

Indicators of Compromise

HTTP requests to /<Client>FacturaE/VerFacturaPDF containing suspicious characters such as <, >, ", ', or encoded variants (%3C, %3E) in the campo parameter.
Requests containing JavaScript keywords like <script>, onerror=, onload=, javascript:, or alert( inside URL query strings.
Referer headers pointing to external, untrusted domains preceding requests to the VerFacturaPDF endpoint.

Detection Strategies

Deploy Web Application Firewall (WAF) rules that inspect the campo query parameter for HTML and JavaScript metacharacters and known XSS signatures.
Enable server-side access logging with full query strings and correlate anomalous parameter payloads with user session identifiers.
Instrument the browser with a strict Content Security Policy (CSP) and monitor CSP violation reports for inline script execution attempts.

Monitoring Recommendations

Alert on outbound requests from user browsers to unknown domains immediately after visits to Quiter Gateway URLs, which may indicate token exfiltration.
Track spikes in 4xx and 5xx responses on the /FacturaE/VerFacturaPDF path, which can indicate payload fuzzing.
Review email gateway logs for messages containing URLs targeting the VerFacturaPDF endpoint with unusually long query strings.

How to Mitigate CVE-2025-40720

Immediate Actions Required

Upgrade Quiter Gateway to version 4.7.0 or later, which contains the vendor's fix for this vulnerability.
Inventory all Quiter Gateway deployments and confirm the installed version against the affected version range.
Notify users of the phishing risk and instruct them not to click Quiter Gateway links received from untrusted sources until patching is complete.

Patch Information

Quiter has addressed this vulnerability in Quiter Gateway version 4.7.0. Administrators should coordinate with Quiter support to obtain the patched build and follow the vendor's upgrade procedure. Additional context is available in the INCIBE Security Notice.

Workarounds

Deploy WAF rules that block or sanitize requests to /<Client>FacturaE/VerFacturaPDF when the campo parameter contains HTML or JavaScript metacharacters.
Enforce a restrictive Content Security Policy that disallows inline scripts and untrusted script sources on the Quiter Gateway origin.
Set the HttpOnly and Secure flags on session cookies to limit the impact of script execution on session tokens.
Restrict access to the Quiter Gateway application through VPN or IP allow-listing until the upgrade is completed.

bash

# Example ModSecurity rule to block script payloads in the campo parameter
SecRule REQUEST_URI "@rx /FacturaE/VerFacturaPDF" \
  "chain,id:1040720,phase:2,deny,status:403,\
   msg:'CVE-2025-40720 Quiter Gateway XSS attempt'"
  SecRule ARGS:campo "@rx (?i)(<script|onerror=|onload=|javascript:|alert\()" \
    "t:none,t:urlDecodeUni"